Detecting malicious codes

Abstract

A malicious code detection method includes: registering information on an incoming TCP connection setup packet to an internal network and storing contents of a TCP data packet for the registered connection; storing data for the corresponding TCP connection upon a connection determined to request a traffic connection of the same feature as the incoming TCP traffic within a predetermined time during a TCP connection setup being directed to an external network; and determining a data packet to be malicious code upon a determination that the data packet of the outgoing TCP traffic is the same as the registered incoming TCP traffic data packet.

1 . A method comprising: 
 registering information on an incoming TCP connection setup packet to an internal network and storing contents of a TCP data packet for the registered connection;    storing data for the corresponding TCP connection upon a connection determined to request a traffic connection of the same feature as the incoming TCP traffic within a predetermined time during a TCP connection setup being directed to an external network; and    determining a data packet to be malicious code upon a determination that the data packet of the outgoing TCP traffic is the same as the registered incoming TCP traffic data packet.    
   
   
       2 . The method according to  claim 1 , wherein the incoming TCP traffic is stored in an incoming TCP connection table and the outgoing TCP traffic is stored in an outgoing TCP connection table.  
   
   
       3 . The method according to  claim 2 , wherein the incoming TCP connection table comprises at least one entry including a source IP address, a destination IP address, a source TCP port number, a destination TCP port number, an entry registration time, and at least one data packet storage space.  
   
   
       4 . The method according  claim 2 , wherein the outgoing TCP connection table comprises at least one entry including a source IP address, a destination IP address, a source TCP port number, a destination TCP port number, an entry registration time, and at least one data packet storage space.  
   
   
       5 . The method according to  claim 2 , wherein registering information on an incoming TCP connection setup packet to an internal network and storing contents of a TCP data packet for the registered connection comprises registering the corresponding traffic with the incoming TCP connection data upon the corresponding packet not being registered in the incoming TCP connection data and the incoming traffic being a TCP SYN packet.  
   
   
       6 . The method according to  claim 5 , wherein: 
 information on a source IP address, a destination IP address, a source TCP port, and a destination TCP port among header information of the incoming traffic TCP SYN packet is registered in the same item of the incoming TCP connection table;    an entry registration time is the time when the TCP SYN packet is registered; and    no data is registered in a data storage space of the incoming TCP connection table.    
   
   
       7 . The method according to  claim 2 , wherein registering information on an incoming TCP connection setup packet to an internal network and storing contents of a TCP data packet for the registered connection further comprises: 
 comparing header information of the corresponding packet with the same item of each entry of the incoming TCP connection table and determining whether the corresponding traffic is registered in the incoming TCP connection table upon the incoming traffic being a TCP data packet; and    registering pure data information of the incoming TCP data packet in a data packet field of the corresponding entry upon an entry identical to the incoming TCP data packet being found as a result of the determination.    
   
   
       8 . The method according to  claim 7 , wherein the data packet field comprises at least one storage space having a maximum value that is changeable by an operator.  
   
   
       9 . The method according to  claim 7 , wherein comparing header information of the corresponding packet with the same item of each entry of the incoming TCP connection table and determining whether the corresponding traffic is registered in the incoming TCP connection table upon the incoming traffic being a TCP data packet comprises: comparing information on a source IP address, a destination IP address, a source TCP port, and a destination TCP port, and determining the information on the header of the incoming TCP data packet and the information on the incoming TCP connection table to be identical only when all of the comparison items are the same.  
   
   
       10 . The method according to  claim 10 , wherein storing data for the corresponding TCP connection upon a connection determined to request a traffic connection of the same feature as the incoming TCP traffic within a predetermined time during a TCP connection setup being directed to an external network comprises registering information on the TCP SYN packet in an outgoing connection table upon information on the corresponding packet being compared with each entry registered in the incoming TCP connection table and an entry including the same information and the outgoing traffic being a TCP SYN packet.  
   
   
       11 . The method according to  claim 2 , wherein determining that TCP SYN packet information and TCP connection table entry information are the same traffic comprises: determining that a source IP address of the TCP SYN packet and a destination IP address of the incoming TCP connection table entry are the same, and a destination TCP port number of the TCP SYN packet and a destination TCP port number of the TCP connection table entry are the same.  
   
   
       12 . The method according to  claim 2 , wherein storing data for the corresponding TCP connection upon a connection determined to request a traffic connection of the same feature as the incoming TCP traffic within a predetermined time during a TCP connection setup being directed to an external network further comprises: 
 comparing a header of the corresponding packet and each entry information of the outgoing TCP connection table upon the outgoing traffic being a TCP data packet;    comparing contents of pure data of the outgoing TCP data packet with contents of a data packet stored in a data storage space of the corresponding entry upon a determination that entry information is the same traffic as the outgoing TCP data packet; and    determining the outgoing TCP traffic to be generated by a malicious code upon a determination that the two data are identical as a result of the packet comparison.    
   
   
       13 . The method according to  claim 2 , wherein each entry of the incoming TCP table or the incoming TCP table is deleted from the corresponding table after the passage of a predetermined time period from an entry registration time.  
   
   
       14 . The method according to  claim 3 , wherein information stored in the data packet storage space comprises a checksum value of transmitted pure data.  
   
   
       15 . The method according to  claim 4 , wherein information stored in the data packet storage space comprises a checksum value of transmitted pure data.  
   
   
       16 . A method comprising: 
 registering an incoming UDP connection to an internal network and storing contents of a UDP data packet for the registered connection;    determining that an internal host, connected to outside by a connection request received from outside, has requested a connection to the same destination UDP port within a predetermined time, among the UDP connections directed to an external network from the internal network and an outgoing UDP traffic registration to store data for the corresponding UDP connection; and    determining that a packet is malicious code upon a determination that the outgoing UDP connection data packet and the packet registered with the incoming connection data are the same.    
   
   
       17 . The method according to  claim 16 , wherein registering and storing UDP data comprises generating a UDP table entry and storing the corresponding data packet upon the same data packet having not been received within a session timeout time period of a previous UDP session for a specific data packet.  
   
   
       18 . An apparatus comprising: 
 a database including an outgoing TCP connection table adapted to register incoming TCP packet setup packet information to an internal network, and to store data for the corresponding TCP connection upon an incoming TCP connection table storing contents of a TCP data packet for the registered connection and a TCP connection directed to an external network from the internal network receiving a connection request from outside and an internal host connected to the outside requesting a connection to the same destination TCP port within a predetermined time period; and    a controller connected to the incoming and outgoing TCP connection tables and adapted to register, compare and store data and to determine a data packet to be malicious code upon a data packet of the outgoing TCP traffic being the same as the registered incoming TCP traffic data packet.    
   
   
       19 . The apparatus according to  claim 18 , wherein the apparatus is arranged in a bottleneck between the internal network and an external Internet network.